CVE-2021-42237

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

97.57% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2022-03-25, used in ransomware campaigns

Nuclei

critical · CWE-502

Published

2021-11-05

Updated

2026-07-09

Proof-of-concept exploits (3)

• ItsIgnacioPortal/CVE-2021-4223714★ · 2022-01-16
• PinkDev1/CVE-2021-4223714★ · 2022-01-16
• vesperp/CVE-2021-42237-SiteCore-XP1★ · 2022-06-30

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42237.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/sitecore_xp_cve_202…

Security advisories

• https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776
• http://packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-E…
• https://blog.assetnote.io/2021/11/02/sitecore-rce

References

• CVE Record
• NVD entry

Related

• CVE-2021-20038
• CVE-2022-1388
• CVE-2022-26134